Predicate abstraction and CEGAR for higher-order model checking

Kobayashi, Naoki; Satô, Ryôsuke; Unno, Hiroshi

doi:10.1145/1993316.1993525

Cited by 62 publications

(87 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Two main techniques followed are higher-order recursion schemes modelling [12,18], and symbolic execution [21,9,11]. In the first category, MoCHi [13] performs full verification of OCaml programs by translating them into higher-order recursion schemes checked with specialised tools. In the second category, Rosette [24], Kaplan [14], and Rubicon [16] perform symbolic evaluation for Racket and Ruby respectively by using solver-aided languages for functional and imperative higher-order programs.…”

Section: Related Workmentioning

confidence: 99%

“…BMC-2 itself was written in OCaml. To illustrate our input language, on the right is sample program mc91-e from [13] translated from OCaml to our syntax. The keyword Methods is used to define all methods in the repository.…”

Section: Implementation and Experimentsmentioning

confidence: 99%

“…Benchmarks We tested our implementation on a set of 40 programs that include a selection from the MoCHi benchmark [13]; a set of higher-order programs written in OCaml, originally used to test the higher-order model checking tool MoCHi [13], and subsequently used for benchmarking [23,4,22]. We added custom samples with references In this set we have of safe and unsafe programs denoted by the -e termination in their filename.…”

Section: Implementation and Experimentsmentioning

confidence: 99%

“…This can be seen with our examples for 100 to 400 lines of code, which were correctly shown to have bugs, with little difficulty despite the increase in program size. In addition to testing BMC-2, we also ran comparison experiments on prior tools MoCHi [13] and Rosette [24]. All experiments ran on the same machine used to test BMC-2.…”

Section: Implementation and Experimentsmentioning

confidence: 99%

“…We optimise the translation by restricting such choices according to a simple points-to analysis. In Section 5 we present an implementation of our technique in a BMC tool for a higher-order OCaml-like syntax extending HORef, and test it on several example programs adapted from the MoCHi benchmark [13]. Finally, we compare our tool with MoCHi and an implementation of our bounded operational semantics in Rosette [24].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Bounded Model Checking Technique for Higher-Order Programs

Lin

Tzevelekos

2019

Dependable Software Engineering. Theories, Tools, and Applications

View full text Add to dashboard Cite

We present a Bounded Model Checking technique for higherorder programs based on defunctionalization and points-to analysis. The vehicle of our study is a higher-order calculus with general references. Our technique is a symbolic state syntactical translation based on SMT solvers, adapted to a setting where the values passed and stored during computation can be functions of arbitrary order. We prove that our algorithm is sound and provide a prototype implementation with experimental results showcasing its performance. The first novelty of our technique is a presentation of defunctionalization using nominal techniques, which provides a theoretical background to proving soundness of our technique, coupled with SSA adapted to higher-order values. The second novelty is our use of defunctionalization and points-to analysis to directly encode general higher-order functional programs.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Implementation and Experimentsmentioning

confidence: 99%

Section: Implementation and Experimentsmentioning

confidence: 99%

Section: Implementation and Experimentsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Bounded Model Checking Technique for Higher-Order Programs

Lin

Tzevelekos

2019

Dependable Software Engineering. Theories, Tools, and Applications

View full text Add to dashboard Cite

show abstract

Manifest Contracts with Intersection Types

Nishida

Igarashi

2019

Programming Languages and Systems

View full text Add to dashboard Cite

We present a manifest contract system PCFv∆H with intersection types. A manifest contract system is a typed functional calculus in which software contracts are integrated into a refinement type system and consistency of contracts is checked by combination of compile-and run-time type checking. Intersection types naturally arise when a contract is expressed by a conjunction of smaller contracts. Run-time contract checking for conjunctive higher-order contracts in an untyped language has been studied but our typed setting poses an additional challenge due to the fact that an expression of an intersection type τ1 ∧ τ2 may have to perform different run-time checking whether it is used as τ1 or τ2. We build PCFv∆H on top of the ∆-calculus, a Church-style intersection type system by Liquori and Stolze. In the ∆-calculus, a canonical expression of an intersection type is a strong pair, whose elements are the same expressions except for type annotations. To address the challenge above, we relax strong pairs so that expressions in a pair are the same except for type annotations and casts, which are a construct for run-time checking. We give a formal definition of PCFv∆H and show its basic properties as a manifest contract system: preservation, progress, and value inversion. Furthermore, we show that run-time checking does not affect essential computation.

show abstract

Temporal Refinements for Guarded Recursive Types

Jaber

Riba

2021

Programming Languages and Systems

View full text Add to dashboard Cite

We propose a logic for temporal properties of higher-order programs that handle infinite objects like streams or infinite trees, represented via coinductive types. Specifications of programs use safety and liveness properties. Programs can then be proven to satisfy their specification in a compositional way, our logic being based on a type system.The logic is presented as a refinement type system over the guarded $$\lambda $$ λ -calculus, a $$\lambda $$ λ -calculus with guarded recursive types. The refinements are formulae of a modal $$\mu $$ μ -calculus which embeds usual temporal modal logics such as and . The semantics of our system is given within a rich structure, the topos of trees, in which we build a realizability model of the temporal refinement type system.

show abstract

Predicate abstraction and CEGAR for higher-order model checking

Cited by 62 publications

References 38 publications

A Bounded Model Checking Technique for Higher-Order Programs

A Bounded Model Checking Technique for Higher-Order Programs

Manifest Contracts with Intersection Types

Temporal Refinements for Guarded Recursive Types

Contact Info

Product

Resources

About